1 ENISA’s contribution to the development of Network and Information Security within the Community By Andrea PIROTTI Executive Director ENISA Cyprus, 28.

1

ENISA’s contribution to the development of

Network and Information Security

within the Community By

Andrea PIROTTI

Executive Director ENISA

Cyprus, 28 April 2006

2

Structure

1. Overview of ENISA

2. Status of ENISA Activities

3. Current work – focus on requests

4. ENISA plans for the future

3

Overview: ENISA Facts• ENISA: European Network and Information Security Agency• Operational since September 2005• Headquarters: Heraklion, Crete, Greece• Staff: 1 Executive Director, 3 Heads of Department, 13 Experts

and 3 Seconded National Experts

Crete

The Team

4

Overview: ENISA’s Objectives

To provide assistance and deliver advice to the Commission and the MS on issues related to NIS falling

within its competencies as set out in this Regulation

To enhance the capability of the Commission, other EU bodies and the Member States to prevent,

address and to respond to NIS problems

To develop a high level of expertise and use this expertise to stimulate broad cooperation

between actors from the public and private sectors

To assist the Commission, where called upon, in the technical preparatory work

for updating and developing Community legislation in the field of NIS.

5

Management BoardManagement Board

Executive Director (and staff)Executive Director (and staff)

Permanent Stakeholders GroupPermanent Stakeholders Group

Ad hoc Working GroupsAd hoc Working Groups

ENISA

• Approve Working Programme• Approve budget

• “Run the Agency”• Reports to Management Board

• Input for Working Programme and WG-work• Advice to Executive Director

• Technical advice on specific questions/tasks• Report to ED• 3 WG in 2005, 4 in 2006

Overview: ENISA bodies & groups

6

Overview: ENISA’s Tasks

Giving advice and assistance to

Commission andMember States

Risk assessment

and riskmanagement

Promote CERTs

Information exchange

and cooperation

Trackstandardisation

Promote best practices

Awareness raising

Becoming a centre of expertise

7

2. Status of ENISA Activities:Risk Management

Establishing a common language Compiling best practices for Risk Management Proposing interoperable Risk Management solutions Road-mapping emerging risks in interconnected networks Compiling an inventory of methods and tools for Risk

Management Preparing Information packages for Risk Management at

the example of two different types of SMEs

8

Status: Technical & Procedural Security Policies

Identifying best practices for technical and procedural security policies

Compiling an inventory of measures that providers adopt to comply with the legislation (including measures against spam)

Creating a knowledge-database of best practices

Making a roadmap for how to create a common language between MS for identifying level of security

Original Infosec Guide(e.g.

Documents)

Infosec Control

1. Collect Best Practice Guides, Best Practice Policies and Best Practice Controls

Infosec Policy

Infosec ControlInfosec

ControlInfosec Control

Infosec Policy

Infosec ControlInfosec

ControlInfosec Control

Gen.Infosec Guide

Gen. Infosec Policy

Infosec ControlInfosec

ControlInfosec Control

Gen.Infosec PolicyInfosec ControlInfosec

ControlInfosec Control

Infosec ControlInfosec ControlInfosec ControlInfosec ControlInfosec Control

Infosec ControlInfosec ControlInfosec ControlInfosec ControlInfosec ControlInfosec Control

Original Infosec Control

Original Infosec Policy(e.g.

Chapters)

Gen. Infosec Policy

Infosec ControlInfosec

ControlInfosec Control

4. Store these pieces of

Guides, Policies and Controls

also in the Knowledgebase

Best Practice Knowledgebase

2. Store Guides, Policies and Controls in the Knowledgebase

5. Create new brief, simple, broadly accepted Guides & Policies

3. Extract most relevant & valuable pieces

9

Status: NIS TechnologiesAnalysis of the major technical developments

in relation with standardization and other NIS initiatives.

Security and user experience.Presence of ENISA in various fora and

establishment of a network of contacts in the technical, development, standardization, and research community.

Dissemination through different channels

10

Status: Awareness Raising Compiling a practical guide on awareness

raising Revisiting the Information Package 2005 and

elaborate on the current trends and progress in the awareness raising field. An inventory of Member States best practices will be delivered and compiled in a CD Rom

Developing a communication plan to disseminate the Information Package 2006

Disseminating the main findings among the Member States representatives organising a focused workshop

11

Status: Relations with Industry and International Institutions

Maintaining regular dialogue with the industry, consumers, academic and other relevant stakeholders Manage ENISA’s Advisory Board: the Permanent

Stakeholders Group (PSG) Setting up networks with industry and international

organisations Create a NIS - “Who’s Who”

directory of all relevant stakeholders Identify the current level of cooperation e.g CERTs Identify efficient platforms for networking Meet with relevant stakeholders

Liaising with Third Countries

12

Status: Coordination of activities with Member States and European Bodies

Managing the NLOs Network Strengthening relations with

EU bodies Managing the Who is Who

Database and Who is Who Directory

Updating country pages Request Handling

ENISA as a platform for information exchange

13

Status: ENISA & CERTsENISA’s Inventory of CERT activities in Europe

(Publicly listed teams and activities)

2005: Stock-Taking

14

3. Current work focus? Requests

Request from Lithuania in the field of CERT

Request from Commission on Security Measures adopted by Electronic Communication Service Providers

Request from Commission: comment their new proposal on increased security in electronic communications

ESignature study

15

Commission Request on Security Measures adopted by ElectronicCommunication Service Providers

ENISA contributes to Regulatory Process of Commission

Security measures of ECSP. Context of personal data (mainly spam & malware)(Dir 2002/58)

Close to citizens - we all receive spam!ENISA is already in contact with all

NRA & access providersReport to Commission in February

16

Request from Lithuania in the field of CERT

1st Request from a MS. NB- ENISA also work for MS bodies!

ENISA has not been, is not & will never be a CERT!

But: ENISA can help MS with assistance, (e.g. providing CERT training in Lithuania)

17

Thank you and Stay in touch with ENISA!

http://www.enisa.europa.eu

Go to our website: Subscribe to our Quarterly Newsletter:

Meet us in Rome!